Was your CRA profile hacked? A $8.7M lawsuit settlement claim is now open

Most serious cases for those affected in 2020 could be eligible for $5,000

A person looks at the Canada Revenue Agency MyCRA login screen on Feb. 28. On Tuesday, the claims process opened for those eligible for compensation in a 2020 data breach that affected tens of thousands of people.

Photo: The Canadian Press / Giordano Ciampini

Natalie Stechyson (new window) · CBC News

Nothing in this life is certain, except for death — and maybe getting a payout if you were hacked for paying taxes.

The claims process is now open (new window) for those seeking their share of a $8.7-million settlement (new window) in a class-action lawsuit involving tens of thousands of Canadians whose sensitive information was compromised or stolen in 2020, when hackers got into their accounts on government websites, including the Canada Revenue Agency (CRA) portal.

Compensation could be as much as $5,000 for the most serious cases, according to the details posted by KPMG, the administrator for the lawsuit.

This settlement has been found to be fair, reasonable, and in the best interests of the class members. It represents a compromise of disputed claims and is not an admission of wrongdoing,the Treasury Board of Canada Secretariat said in a statement posted Tuesday (new window).

Hackers targeted government accounts over several months in 2020 largely for the purpose of applying for financial aid in the victims' names during the earliest months of the COVID-19 pandemic, including the Canada Emergency Relief Benefit (CERB) or the Canada Emergency Student Benefit (CESB).

Tens of thousands of people had their personal and financial information compromised that summer alone, from social insurance numbers and home addresses, to details of their bank accounts.

The class-action settlement reached last December and was approved in court in May (new window). The claims process opened Tuesday.

Eligible class members can submit their claims online (new window) or by mail until Feb. 3, 2027.

WATCH | From 2020: Thousands of CRA accounts hacked in cyberattack:

It's important to note that not all class members are eligible for payments under the settlement agreement, KPMG points out.

Class members are those whose personal or financial information in a Government of Canada online account was disclosed to a third party without authorization between March 1, 2020, and Dec. 31, 2020.

But only those class members who were victims of unauthorized access between June 15 and Aug. 13, 2020, and whose personal information was accessed, or accessed and used for fraudulent purposes, are entitled to payments, KPMG said.

You’re also eligible if you received a notice from KPMG.

You can check your eligibility on the KGMP website's eligibility page (new window), where you will be asked to provide your last name and the last three digits of your social insurance number.

There are three classes of applicants:

Payment amounts may be reduced depending on the number of approved claims, according to a notice from the Federal Court of Canada. (new window)

Eligible claimants can apply on the KPMG website (new window). You can also download a claim form (new window) on the website, or email breachsettlementcanada@kpmg.ca (new window) for more information.

If there's any money from the settlement amount left over or left unclaimed, Ottawa agreed to donate the excess to the Privacy and Access Council of Canada to fund privacy research.

The Government of Canada has denied any wrongdoing. (new window)

Natalie Stechyson has been a writer and editor at CBC News since 2021. She covers stories on social trends, families, gender, human interest, as well as general news. She's worked as a journalist since 2009, with stints at the Globe and Mail and Postmedia News, among others. Before joining CBC News, she was the parents editor at HuffPost Canada, where she won a silver Canadian Online Publishing Award for her work on pregnancy loss. You can reach her at natalie.stechyson@cbc.ca.

With files from Rhianna Schmunk